OAuth PKCE and DPoP notes
Decide whether the advertised PKCE and DPoP requirements match what the token endpoint enforces on a login you complete.
Level: intermediate
Tools: Burp Suite, browser devtools
Pipeline
Read the authorization-server metadata for {issuer}, complete one normal login, and note whether code_challenge, code_verifier, and any DPoP proof are required before a token is issued.